Budget for an executive working session, not a keynote
Cost of a Cybersecurity Tabletop Exercise
An executive tabletop is a working session for the people who must make decisions during an incident. Use this guide to define the scope, compare proposals on the same basis, and discuss a tailored exercise with Mark Lynd.
What Determines the Cost?
Cybersecurity tabletop exercise cost depends on the scenario, preparation, number of participants, delivery format, and after-action work. Ask for an itemized quote that separates facilitation, travel, written findings, and follow-up support. A scoped proposal is more useful than a headline fee for a different exercise.
Compare Exercise Formats, Not Just Fees
A shorter session is not automatically a smaller engagement. Scenario research, preparation with leadership, and the depth of follow-up can matter as much as the time in the room. These are scoping options to discuss, not fixed-price packages.
Focused Executive Exercise
A single scenario and a defined leadership group. Compare preparation time, participant briefing, facilitation, and the level of written findings.
Best for: Testing one decision path or a first executive tabletop
Multi-Vector Exercise
Linked scenarios such as ransomware, AI-enabled impersonation, or disruption across suppliers. Ask how injects, cross-functional decisions, and a debrief will be designed.
Best for: Teams testing coordination across several functions
Multi-Team or Multi-Day Program
A broader program involving several teams or organizations. Scope coordination, scenario dependencies, reporting, travel, and follow-up as distinct line items.
Best for: Complex operating environments and deeper follow-through
Self-Led or Externally Facilitated?
A self-led exercise may suit a team that already has a facilitator, a defined scenario and time to prepare. CISA tabletop planning resources can help you structure the work. An external facilitator may be useful when you want someone outside the participating team to guide the discussion and capture decision gaps. Compare the preparation, facilitation and reporting in each option, not just the time spent in the session.
Before requesting a proposal, decide whether you need a discussion-only exercise, written observations, an action-owner list or a later follow-up session. Confirm those deliverables explicitly; they are not automatically included in every engagement.
What to Include in Your Tabletop Brief
- The decision you want to test. Examples include incident command, containment authority, recovery priorities, and executive communication.
- The people in the room. Approximate participant count, roles, and whether multiple teams or organizations are involved.
- The scenario and format. High-level scenario focus, preferred date or window, virtual or on-site delivery, and location.
- The outputs you need. Debrief, written findings, remediation owners, a board summary, or follow-up sessions.
- The commercial boundaries. Budget range if known, travel expectations, procurement requirements, and what should be optional.
Keep the initial brief high-level. Do not send sensitive incident details, credentials, or confidential system information through the public inquiry form.
Discuss Your Exercise →An Executive Tabletop Should Test Decisions
Decision ownership. Identify who can declare an incident, approve containment, authorize recovery, and brief the board.
Cross-functional coordination. Bring technology, operations, legal, communications, finance, and leadership into the same scenario.
Evidence and follow-through. Agree how observations, decision gaps, remediation owners, and follow-up work will be documented.
Practitioner context. Mark is a 5x CEO/CIO/CISO. His tabletop work is grounded in The 72-Hour IR Executive Playbook.
Looking for a conference presentation rather than a facilitated exercise? Explore Mark's speaking topics and formats.